CyberRota Analysis
AI-GeneratedPraisonAI versions prior to 4.6.58 are vulnerable due to a lack of credential checks in the _create_agents_app() and _create_unified_app() functions, allowing unauthenticated users to access sensitive endpoints such as POST /agents and POST /api/v1/agents/{id}/invoke. This vulnerability could lead to unauthorized agent creation and invocation, potentially compromising the integrity and security of the multi-agent system. Organizations using affected versions should prioritize upgrading to version 4.6.58 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but _create_agents_app() and _create_unified_app() do not install a credential check. Unauthenticated callers can reach POST /agents and POST /api/v1/agents/{id}/invoke. This issue is fixed in version 4.6.58.